This Privacy Policy explains how Arrax Marketing ("Arrax Marketing", "we", "us", "our") handles personal data in Arraxis. It covers our website at arraxis.site, the Arraxis app at app.arraxis.site, and the booking pages and forms that businesses publish with Arraxis.
Arraxis is a CRM, automation and AI platform for businesses. Arrax Marketing builds, operates and sells it.
1. Our role: controller and processor
Data protection law treats us differently depending on whose data it is.
- Account data and website visitors. For the people who sign up for and use Arraxis (account users), and for visitors to our website, Arrax Marketing is the data controller. We decide how and why this data is used.
- Lead and customer data. When a business puts data about its own leads and customers into Arraxis, that business is the controller and Arrax Marketing is its processor. We only process that data to provide the Service to the business, on its instructions and under our Terms of Service.
- If you are a lead or customer of a business that uses Arraxis, please contact that business first about your data. It decides how your data is used. We will help the business respond to you.
2. Data we collect
Account data
When you or your team use Arraxis, we collect your name, email address and phone number, and your password. Passwords are stored hashed with bcrypt, so we cannot read them.
Payments are handled by our billing provider. It receives the billing and payment details needed to take payment.
Lead and customer data
Businesses use Arraxis to collect and manage leads. This data can include a lead's name, phone number, email address, city and the service they are interested in. Where the business collects it, it can also include age and gender.
Leads reach Arraxis from sources the business connects, including:
- Facebook and Instagram lead ads
- Google Ads lead forms
- website forms (by webhook) and the Arraxis WordPress plugin
- the Shopify contact form
- Google Forms and Google Sheets
- Arraxis forms and the Arraxis booking page
- CSV and Excel imports
- the Arraxis REST API
Meta data
When a business connects its Meta account, we receive lead form submissions and ad performance statistics for the ad account the business selects.
Messages
Arraxis has a shared inbox. It stores the WhatsApp messages, emails and SMS messages a business sends and receives through its own connections.
- WhatsApp runs on the official WhatsApp Business Platform (Cloud API).
- Email is sent from mail.arraxis.site under the business's name. Replies go to the business's own email address.
- SMS is sent through the business's own Twilio account.
Google Calendar data
Only when a team member connects their own Google Calendar. Section 5 explains exactly what we access and why.
Usage records
We store records of the work done in Arraxis. These include calls logged, notes, pipeline stages, appointments and automation activity. Admin changes are written to an audit log.
Website visitors
Our marketing website sets no cookies and loads no analytics or advertising pixels by default. See our Cookie Policy. Like any website, our hosting provider processes technical data such as IP addresses to deliver pages and keep them secure.
When you contact us
If you email us, we keep your message and our reply so we can help you.
3. How we use data, and our legal bases
Where the GDPR or UK GDPR applies, we rely on these legal bases for the data we control:
| What we do | Legal basis |
|---|---|
| Create and run your account and workspace | Performance of our contract with you |
| Take payment, send invoices and keep billing records | Contract, and legal obligations such as tax law |
| Send service emails, such as trial reminders, billing notices and security alerts | Contract |
| Keep the Service secure and prevent abuse | Legitimate interests |
| Improve and support the Service | Legitimate interests |
| Connect a Google Calendar or other optional service | Your choice to connect it, which you can undo at any time |
If we send product news to account users, each email has an unsubscribe link.
For lead and customer data, the business that controls the data is responsible for its own legal basis.
4. What we never do
- We never sell personal data.
- We never share one workspace's data with another workspace.
- We never use lead data for Arrax Marketing's own marketing.
5. Google user data
Connecting Google Calendar is optional. A team member chooses whether to connect their own calendar.
What we ask for. We ask for one permission: https://www.googleapis.com/auth/calendar.events. We also receive the email address of the Google account that is connected.
How we use it.
- We use this access only to add, update and delete the appointments your workspace books for that team member.
- If two-way sync is turned on, we also read the start and end times and busy or free status of events in that calendar. We use this only so those times are not offered for booking.
- We never read or keep the titles, descriptions or guests of events that Arraxis did not create.
How we protect it.
- Google access tokens are encrypted with AES-256-GCM.
- Google user data is never sold.
- It is never used for advertising or to build profiles.
- It is never shared with other workspaces or with third parties.
How to remove access. Go to Settings → Calendar & Booking in Arraxis and choose Disconnect. This revokes our access and deletes the tokens and the synced event records. You can also remove access at any time at myaccount.google.com/permissions.
Arraxis's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. AI features
AI features are optional. They stay off until someone in a workspace switches them on for that workspace.
What the AI features do
- summarise leads
- draft replies, which a person on the team reviews and sends
- score leads and explain the reasons
- write messages for automations
- run an AI chat receptionist on WhatsApp
- run an AI phone receptionist
What we send to the AI provider
We only send what a task needs:
- the recent messages in that conversation
- the customer's first name
- the service the customer asked about
- the lead's stage and appointment times
- the business's own services, prices and opening hours
We never send phone numbers, email addresses, ID numbers, card or bank details, deal values, payments or staff notes to the AI provider.
The AI phone receptionist runs through Vapi, our phone call provider. Because Vapi handles the call itself, it receives the call audio and the caller's phone number. See our Sub-processors page.
Who the AI provider is
Today our AI provider is Google (Gemini). We may use Anthropic instead. These providers are in the United States.
How long we keep AI data
- AI results (such as summaries, drafts and scores): 180 days
- Call transcripts: 30 days
- Call recordings: off by default. If a business turns them on, we keep them for 30 days.
Safeguards
- The AI receptionist always says it is an AI.
- A customer can opt out of AI at any time by writing "No AI".
- AI output can be wrong. Staff check it before relying on it.
7. Advertising platforms
Businesses can send conversion data back to their own ad accounts so their ads improve. We never send health information to advertising platforms.
- Meta Conversions API. We send only a neutral stage name such as "Qualified" or "Booked", the Meta lead id, and the lead's phone number and email address in hashed (scrambled) form.
- Google Ads offline conversions. We send only a neutral conversion name and the details Google needs to match the conversion to the ad.
8. Who we share data with
- Sub-processors. We use a limited number of providers to host and run Arraxis, such as Railway for hosting and Resend for email. The full list, with what each one does and where it is located, is on our Sub-processors page.
- Services a business connects. When a business connects Meta, Google, Twilio or Vapi, data moves between Arraxis and that service because the business asked for it. Twilio is used through the business's own account, so it is the business's own provider.
- Legal reasons. We may share data if the law requires it, or to protect our rights, our users or the public.
- Business changes. If Arrax Marketing is merged, sold or reorganised, data may pass to the new owner under this policy. We will tell you first.
9. International transfers
Our AI providers are in the United States. Our database is hosted by Railway. When personal data moves to another country, we protect it with contracts.
10. How long we keep data
- Account and workspace data. We keep it while your account is active. If your trial or subscription ends, the workspace becomes read-only and we keep the data for 60 days. After that we may delete it. We send reminder emails first.
- Lead and customer data. The business decides how long to keep it. We delete it when the business asks, or when the workspace is deleted.
- AI data. See section 6.
- Google Calendar data. Tokens and synced event records are deleted when the calendar is disconnected.
- Billing records. We keep them as long as tax and accounting law requires.
- Backups. Deleted data is removed from backups on our normal backup cycle.
11. Security
We protect data with these measures:
- encrypted connections (HTTPS and TLS)
- passwords hashed with bcrypt
- connection tokens stored encrypted
- each workspace separated at the database level (row-level security)
- role-based access inside each workspace
- admin changes written to an audit log
- export and deletion on request
No system is perfectly secure, but we work to protect your data and fix problems quickly.
Arraxis is a sales and booking CRM, not a medical records system. We do not sign HIPAA business associate agreements. Businesses must not store clinical or medical records in Arraxis.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- correct data that is wrong
- delete your data
- restrict or object to how we use it
- receive your data in a portable format
- withdraw consent at any time, where we rely on consent
- complain to your data protection authority
To use these rights, email support@arraxis.site. We may need to check your identity first. We aim to reply within one month.
If your data is in Arraxis because a business collected it, please contact that business first. We will help it respond. To ask for deletion, see our Data Deletion page.
13. Children
Arraxis is for businesses. Every user must be 18 or older. We do not knowingly collect personal data from children for our own purposes.
14. Cookies
Our website sets no cookies by default. The app uses only strictly necessary cookies. Our Cookie Policy explains the details.
15. Changes to this policy
We may update this policy. If a change is significant, we will tell account users by email or in the app before it takes effect. The date at the top shows when it last changed.
16. Contact
Arrax Marketing
Email: support@arraxis.site